ERROR: (gcloud.builds.submit) Error 403: <SERVICE ACCOUNT> does not have storage.objects.get access to the Google Cloud Storage object

Question

I am trying to build a docker image from the Pub/Sub tutorial on Google (link here). I am running this command: gcloud builds submit --tag gcr.io/project_id/pubsub but for some reason I get the error mentioned in the title: ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: could not resolve source: googleapi: Error 403: <SERVICE ACCOUNT> does not have storage.objects.get access to the Google Cloud Storage object., forbidden. I gave the service account the roles/storage.admin role and that didn't work. I even went as far as made the service account an owner and I still got the same error.

Layoff

Answer 1

I figured it out. When using Cloud Build, GCP uses an entirely separate service account for this. It looks something like: <random-id>@cloudbuild.gserviceaccount.com. Add the Cloud Build Service Account role and the Storage Admin role to this service account fixed the problem.

Layoff

The ID isn't random, it's the project number that the service account belongs to. – Cadmarr

I tried your way but still got the error. – Bohannan